Re: [PATCH] kexec_buffer measure

[Casey Schaufler]

On 5/2/2019 8:48 AM, Mimi Zohar wrote:
> [Cc'ing Paul, John, Casey]
>
> On Mon, 2019-04-22 at 20:18 -0400, Mimi Zohar wrote:
> > [Cc'ing LSM mailing list]
> >
> > On Fri, 2019-04-19 at 17:30 -0700, prakhar srivastava wrote:
> >
> > > 2) Adding a LSM hook
> > > We are doing both the command line and kernel version measurement in IMA.
> > > Can you please elaborate on how this can be used outside of the scenario?
> > > That will help me come back with a better design and code. I am
> > > neutral about this.
> > As I said previously, initially you might want to only measure the
> > kexec boot command line, but will you ever want to verify or audit log
> > the boot command line hash?????Perhaps LSMs would be interested in the
> > boot command line. ??Should this be an LSM hook?
>  From an LSM perspective, is there any interest in the boot command line?

I can imagine an LSM that cares about the command line,
but I have an interest in it for any work I have in progress.

> Mimi